Tomcat OIDC deprecation

[stianst]

Keycloak is deprecating most adapters in the future, for more information see https://www.keycloak.org/2023/03/adapter-deprecation-update.html.

The Tomcat adapter has never been extensively used. It shares a large part of the code-base with the WildFly adapter, which is no longer needed since WildFly now has native support for OpenID Connect. With that in mind we are no longer able to justify maintaining the Tomcat adapter.

[dasniko]

Do you have any recommendations for the Tomcat users, to which solution they could/should switch to?

[stianst]

Afraid we're not aware of anything. If anyone has something to suggest that would be great.

Alternatives I could think of is to switch to WildFly, or even Quarkus, leverage Spring, or perhaps use a reverse proxy / API gateway.

[mvanhulsentop]

If you are bound to Tomcat, there are some alternatives.
The KeyCloak servlet filter is mentioned to be not deprecated, so this could be an interesting alternative.
Pac4j has a very nice oidc implementation that also supports a servlet filter (jee).
Still it would be very nice to learn about more alternatives, especially ones that support the native Tomcat valves.

[stianst]

The OIDC servlet filter is being deprecated, but the SAML servlet filter is not.

I fully agree with learning about more alternatives, and perhaps provide some blog/quickstarts/etc material to help folks to migrate. Based on download figures of Tomcat though we need to prioritise the other adapters (and to be honest most of us haven't touched Tomcat for many years), so would be great if someone from the community could help.

[kkcmadhu]

for OIDC Servelet filter , Lets comment on this thread.(#11790)

[stianst]

For authorization services specifically let's move the conversations around that to #11681

[stianst]

We have revised our plans around adapter deprecation, please take a look at https://www.keycloak.org/2023/03/adapter-deprecation-update.html for the updates.